Privacy Policy

A description of what Business OS 365 actually stores today, where it is stored, and who else is involved.

Version 1.0

Effective 30 August 2026 · Last updated 30 August 2026. These documents describe how Business OS 365 works today. They are prepared for professional Malta/EU legal review and are not legal advice. Nothing here is certified, audited, regulator-approved or lawyer-approved.

1. Two different kinds of data

Business OS 365 keeps a strict separation between what is stored on our servers and what stays on your device. Reading this section first makes the rest of the policy clearer.

Server-side (Supabase): your profile (user id, email address, display name, timestamps), your company record (name, business type, country, timezone, currency, optional phone and website, onboarding timestamps), your membership record (which company, which role, status) and billing metadata.
Device-local (your browser): everything you enter in the five operational zones — Inventory, Suppliers, Sales & Invoices, Expenses and Staff.

2. Operational zone records stay in your browser

Zone records are currently held in your browser's local storage on the device you are using. They are not transmitted to a Business OS 365 server database, not synchronised across devices, not visible to us, and not backed up by us.

Those records can contain personal data that you enter — for example supplier and customer contact names, email addresses and phone numbers, and staff names, email addresses, phone numbers and notes. Because that data does not leave your device through this product, you remain in direct control of it, and you are responsible for whether you are entitled to record it.

Business OS 365 is not designed for special-category data such as health, biometric or similar sensitive information, and should not be used to record it.

3. Account and authentication data

Accounts use email and password through Supabase Auth. Email verification is required, and password reset is available by email. There is no social or third-party sign-in. Your session is held in your browser's local storage so you stay signed in.

4. Payments and card data

Payments and subscriptions are handled by Stripe. Card details are entered on Stripe surfaces and are processed by Stripe — they do not reach the Business OS 365 application or database. What we store is subscription metadata: plan, status, billing interval, current period dates, trial end, cancellation state and the provider customer, subscription and price identifiers, plus a record of processed billing events.

5. Intelligence and AI

Business OS 365 Intelligence is deterministic software running locally against records already present. It does not send your prompts, questions or business context to an external generative-AI provider, and no AI conversation is stored. See the Intelligence & AI Transparency Policy.

6. Browser storage

The Cookie Policy lists exactly what is stored in your browser: the authentication session, your operational zone records, a pending-company value and a first-run dismissal flag, interface state in session storage, a sidebar interface cookie, and your cookie-consent record. No analytics or marketing tracking is installed today.

7. Providers involved today

Lovable — Application hosting, build and delivery of the web application. Requests served to the application, plus operational error diagnostics.
Supabase — Authentication and the server-side database holding profiles, companies, memberships and billing metadata. Supabase Auth also sends account emails such as verification and password reset. Email address, display name, company and membership records, billing metadata.
Stripe — Payment processing, subscriptions and the customer billing portal where paid access applies. Payment and card details entered on Stripe surfaces, subscription state.

No analytics provider, marketing platform, CRM or external AI provider is used. Provider hosting locations, international transfer mechanisms and contractual safeguards depend on provider configuration and contracts, and are subject to final review before general availability — they are not asserted here.

8. Error and diagnostic information

Application errors are logged for diagnosis and reliability. Business OS 365 does not operate its own analytics, IP address log, device-fingerprinting or user-agent tracking table. Hosting and infrastructure providers may keep their own operational logs under their own terms.

9. Retention

No fixed retention periods are configured today, so none are claimed. Instead, retention follows criteria:

account, company and membership records are kept while the workspace is in use;
billing metadata is kept while it is needed to operate and evidence the subscription;
device-local zone records persist until you clear them in your browser — we cannot delete them for you because we do not hold them.

Defined retention periods will be published following professional legal review.

10. Your requests

Self-service account deletion and self-service data export are not currently implemented. Requests about your account data can be raised through the legal contact path described below, and will be handled within current technical limits. Device-local zone records can be removed by you directly, by clearing site data for this application in your browser.

11. Security

Traffic is served over HTTPS. Server-side data is protected by database authorization with row-level security so a member only reaches their own company's records, and by role-based access inside the application. Card data is kept with Stripe rather than in this product. No system is perfectly secure, and no certification, audit outcome or guarantee is claimed here.

12. Children

Business OS 365 is a business tool intended for use by companies and their staff. It is not directed at children and is not intended for use by them.

13. Reserved for professional legal review

Lawful bases, controller and processor roles in every scenario, exact retention schedules, international transfer safeguards and the full statement of statutory rights are reserved for professional Malta/EU legal review and are deliberately not asserted in this version.

Operator and contact

Business OS 365 is operated by YK Digital Marketing in Malta. Full operator and contact details — including registered address, company registration and VAT information where applicable — are to be finalised before publication.

Until a published contact address is finalised, legal, privacy and billing requests should be raised through the account or workspace channel you were invited with. A dedicated legal contact address will be published here before general availability.